Re: [Sshmgmt] Agent forwarding

[[e-mail]]

Simon Josefsson writes:
> Briefly, if a remote system has been compromised, and you connect to it
> using 'ssh -A', the remote system can use your credentials to login to
> other systems.  Normally there is no user feedback of what is going on
> either.  I've seen uses of 'ForwardAgent yes' in people's .ssh/config
> which is risky and IMHO a problem worthy of attention.

This is a risk but it's difficult to deal with without removing the
non-interactive SSO that the agent provides and is the reason people
use it.

Also from the man page: "Several identities can be stored in the agent;
the agent can automatically use any of these identities."

What I think could be done are:

a) logging by the agent when it computes a challenge

   The log to include the host public key which the
   challenge proves correct and fresh.  I'm guessing that's
   possible (even if it meant reworking the challenge)
   but haven't studied it.  The aim is that when you are
   blamed for a login you show in the agent log how it was
   assisted by the agent during contact with some other
   list of hosts - one of which is now suspected of using
   the agent without user consent.

b) real-time display by the agent when it computes a challenge

c) limit the agent instance by number/rate of challenges

d) limit the agent instance by which hosts/identities it will
   compute challenges for (again assuming it knows which that is).